[pkg-opensc-commit] [SCM] OpenSC packaging branch, master, updated. f3d730f8ce74c8e4e459be8b8b22648317569262

[Eric Dorland]

The following commit has been merged in the master branch:
commit f3d730f8ce74c8e4e459be8b8b22648317569262
Author: Eric Dorland <eric at debian.org>
Date:   Tue Jan 4 01:28:43 2011 -0500

    * Non-maintainer upload.
    * CVE-2010-4523: Protect against buffer overflow from rogue cards
      (closes: #607427)

diff --git a/debian/changelog b/debian/changelog
index b14275e..60d58b7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+opensc (0.11.13-1.1) unstable; urgency=high
+
+  * Non-maintainer upload.
+  * CVE-2010-4523: Protect against buffer overflow from rogue cards 
+    (closes: #607427)
+
+ -- Jonathan Wiltshire <jmw at debian.org>  Wed, 22 Dec 2010 14:20:22 +0000
+
 opensc (0.11.13-1) unstable; urgency=low
 
   * New upstream release. (Closes: #570107, #505404)
diff --git a/debian/patches/CVE-2010-4523 b/debian/patches/CVE-2010-4523
new file mode 100644
index 0000000..9c0757d
--- /dev/null
+++ b/debian/patches/CVE-2010-4523
@@ -0,0 +1,46 @@
+Description: protect against possible buffer overflows from rogue cards
+ (CVE-2010-4523)
+Origin: https://www.opensc-project.org/opensc/changeset/4913
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607427
+Forwarded: not-needed
+Last-Update: 2010-12-22
+
+--- opensc-0.11.13.orig/src/libopensc/card-acos5.c
++++ opensc-0.11.13/src/libopensc/card-acos5.c
+@@ -140,8 +140,8 @@
+ 	/*
+ 	 * Cache serial number.
+ 	 */
+-	memcpy(card->serialnr.value, apdu.resp, apdu.resplen);
+-	card->serialnr.len = apdu.resplen;
++	memcpy(card->serialnr.value, apdu.resp, MIN(apdu.resplen, SC_MAX_SERIALNR));
++	card->serialnr.len = MIN(apdu.resplen, SC_MAX_SERIALNR);
+ 
+ 	/*
+ 	 * Copy and return serial number.
+--- opensc-0.11.13.orig/src/libopensc/card-atrust-acos.c
++++ opensc-0.11.13/src/libopensc/card-atrust-acos.c
+@@ -853,8 +853,8 @@
+ 	if (apdu.sw1 != 0x90 || apdu.sw2 != 0x00)
+ 		return SC_ERROR_INTERNAL;
+ 	/* cache serial number */
+-	memcpy(card->serialnr.value, apdu.resp, apdu.resplen);
+-	card->serialnr.len = apdu.resplen;
++	memcpy(card->serialnr.value, apdu.resp, MIN(apdu.resplen, SC_MAX_SERIALNR));
++	card->serialnr.len = MIN(apdu.resplen, SC_MAX_SERIALNR);
+ 	/* copy and return serial number */
+ 	memcpy(serial, &card->serialnr, sizeof(*serial));
+ 	return SC_SUCCESS;
+--- opensc-0.11.13.orig/src/libopensc/card-starcos.c
++++ opensc-0.11.13/src/libopensc/card-starcos.c
+@@ -1289,8 +1289,8 @@
+ 	if (apdu.sw1 != 0x90 || apdu.sw2 != 0x00)
+ 		return SC_ERROR_INTERNAL;
+ 	/* cache serial number */
+-	memcpy(card->serialnr.value, apdu.resp, apdu.resplen);
+-	card->serialnr.len = apdu.resplen;
++	memcpy(card->serialnr.value, apdu.resp, MIN(apdu.resplen, SC_MAX_SERIALNR));
++	card->serialnr.len = MIN(apdu.resplen, SC_MAX_SERIALNR);
+ 	/* copy and return serial number */
+ 	memcpy(serial, &card->serialnr, sizeof(*serial));
+ 	return SC_SUCCESS;
diff --git a/debian/patches/min-max-macros b/debian/patches/min-max-macros
new file mode 100644
index 0000000..ea8804a
--- /dev/null
+++ b/debian/patches/min-max-macros
@@ -0,0 +1,38 @@
+Description: move MIN/MAX macros from muscle.c to internal.h (needed for
+ patch CVE-2010-4523)
+Origin: https://www.opensc-project.org/opensc/changeset/4912
+Forwarded: not-needed
+Last-Update: 2010-12-22
+
+--- opensc-0.11.13.orig/src/libopensc/internal.h
++++ opensc-0.11.13/src/libopensc/internal.h
+@@ -50,6 +50,13 @@
+ #define sleep(t)	Sleep((t) * 1000)
+ #endif
+ 
++#ifndef MAX
++#define MAX(x, y) (((x) > (y)) ? (x) : (y))
++#endif
++#ifndef MIN
++#define MIN(x, y) (((x) < (y)) ? (x) : (y))
++#endif
++
+ struct sc_atr_table {
+ 	/* The atr fields are required to
+ 	 * be in aa:bb:cc hex format. */
+--- opensc-0.11.13.orig/src/libopensc/muscle.c
++++ opensc-0.11.13/src/libopensc/muscle.c
+@@ -28,13 +28,6 @@
+ #define MSC_DSA_PUBLIC		0x04
+ #define MSC_DSA_PRIVATE 	0x05
+ 
+-#ifndef MAX
+-#define MAX(x, y) (((x) > (y)) ? (x) : (y))
+-#endif
+-#ifndef MIN
+-#define MIN(x, y) (((x) < (y)) ? (x) : (y))
+-#endif
+-
+ static msc_id inputId = { { 0xFF, 0xFF, 0xFF, 0xFF } };
+ static msc_id outputId = { { 0xFF, 0xFF, 0xFF, 0xFE } };
+ 
diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644
index 0000000..0b02b2e
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1,2 @@
+min-max-macros
+CVE-2010-4523

-- 
OpenSC packaging